a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe
Size

370KB
MD5

54fa88683d42d3582223687bf5288e8b
SHA1

7f647bbddfbc3e62c50b24841a122f50c1f77436
SHA256

a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27
SHA512

3fa7d6391f3f4ffe421eaf99029f5cb48d21ae023050f5edb25d76dee9bd9018920ef37c98b4ee60452d14ba886f428856f8f5d0954701678ea17dc8bc33001b
SSDEEP

6144:MeTeM/rbHqpJLZ1HZe0Tb51VYW30gOS6ehFICbl/6zTvFKQE3I8Zj:MMzGpJd15e0TZYGOUx639KnI8Zj

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2180	a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe
2180	a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe
2180	a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe
2180	a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe
2180	a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe
2180	a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe
2180	a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe
"C:\Users\Admin\AppData\Local\Temp\a589ee367767546f83fc27358bcbb1759f719dd6250c87e1f34d3bce4a322f27.exe"
1⤵
- Loads dropped DLL
PID:2180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsu6CE9.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6CE9.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6CE9.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6CE9.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6CE9.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6CE9.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsu6CE9.tmp\inetc.dll

Filesize
20KB

MD5
50fdadda3e993688401f6f1108fabdb4

SHA1
04a9ae55d0fb726be49809582cea41d75bf22a9a

SHA256
6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

SHA512
e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8

Download Submit